Attack and Defense greatly affect damage.
There is an equation used by the game, but it never reveals exactly what that formula is. However, after lots of testing I believe we've finally figured out what that formula is. You can see how it was done on Reddit here!
Damage = Floor(0.5 * (Attack / Defense) * (CpM_Atk / CpM_Def) * STAB * Type * Power) + 1
- Floor(...) : This is a math function were the result is always rounded down.
- Attack : This is the total attack stat of the attacker (base attack + attack IV).
- Defense : This is the total defense stat of the defender (base defense + defense IV).
- CpM_Atk : This is the CP_Multiplier based on the level of the attacker.
- CpM_Def : This is the CP_Multiplier based on the level of the defender.
- STAB : This is the Same-Type Attack Bonus, which is equal to 1.25. It is only applied if the type of the attack move is the same as one of the attacker's types.
- Type : This is the type effectiveness of the attack, which can be either 0.64, 0.8, 1.0, 1.25, or 1.5625, depending on whether the attack is "super effective" or "not very effective".
- Power : This is the base power of the move used by the attacker.
Note: Testing has determined that critical damage is not currently implemented in Pokemon GO, so it is not included in the formula.
Note: Some versions of the formula do not have "CpM_Atk / CpM_Def". This means that those numbers were already factored into "Attack / Defense". I choose to separate these so that it is more clear how a pokemon's level affects damage.
Extra Information
The base Attack and Defense stats for all pokemon: here.
The CP_Multiplier for each pokemon level: here.
The type effectiveness for all 18 types: here
Information about what IV's are: here.
Example #1
Attack = 100
Defense = 50
CpM_Atk = 0.7317 (level 30)
CpM_Def = 0.5974 (level 20)
STAB = 1.25
Effectiveness = 1.25
Power = 25
Damage = Floor(0.5 * (100 / 50) * (0.7317 / 0.5974) * 1.25 * 1.25 * 25) + 1
Damage = Floor(0.5 * (2) * (1.2248) * 1.5625 * 25) + 1
Damage = Floor(1.9138 * 25) + 1
Damage = Floor(47.845) + 1
Damage = 47 + 1
Damage = 48
Example #2
Now for a real example, and I will go into much more detail this time. Let's say a level 20 Venusaur attacks level 20 Bulbasaur with Razor Leaf. Let's also assume Venusaur's IV's are all 12, and Bulbasaur's IV's are all 9.
Attack = 210
Venusaur's base attack stat is 198. Its Attack IV is 12, so we add those together to have a combined attack stat of 210 (198 + 12).
Defense = 135
Bulbasaur's base defense stat is 126. Its Defense IV is 9, so we add those together to have a combined defense stat of 135 (126 + 9).
CpM_Atk = 0.5974
Venusaur is level 20, and the CP_Multiplier for that level is 0.5974.
CpM_Def = 0.5974
Bulbasaur is level 20, and the CP_Multiplier for that level is 0.5974.
STAB = 1.25
Venusaur is a Grass/Poison type pokemon. Razor Leaf is a Grass type attack. Since the attack type matches one of Venusaur's types, the attack deals bonus damage.
Type = 0.64
Vine Whip is a Grass type attack being used against a Grass/Poison type pokemon.
Grass type attacks are not very effective against Grass type pokemon (x0.8).
They are also not very effective against Poison type pokemon (x0.8).
These two damage multipliers combine to make the attack double ineffective. 0.8 * 0.8 = 0.64.
Power = 15
The base damage for Razor Leaf is 15.
Damage = Floor(0.5 * (210/135) * (0.5974 / 0.5974) * 1.25 * 0.64 * 15) + 1
Damage = Floor(0.5 * (1.5556) * (1) * 0.8 * 15) + 1
Damage = Floor(0.6222 * 15) + 1
Damage = Floor(9.333) + 1
Damage = 9 + 1
Damage = 10
Example #3
Now let's do the reverse of the above: Bulbasaur attacks Venusaur with Razor Leaf.
Attack = 135 (126 + 9)
Defense = 212 (200 + 12)
CpM_Atk = 0.5974 (level 20)
CpM_Def = 0.5974 (level 20)
STAB = 1.25
Type = 0.64
Power = 15
Damage = Floor(0.5 * (135 / 212) * (0.5974 / 0.5974) * 1.25 * 0.64 * 15) + 1
Damage = Floor(0.5 * (0.6368) * (1) * 0.8 * 15) + 1
Damage = Floor(0.2547 * 15) + 1
Damage = Floor(3.8205) + 1
Damage = 3 + 1
Damage = 4
Summary
Example 1 showed how both attack/defense and level affect damage.
Example 2 & 3 showed that when pokemon are the same level, attack and defense play a large role in damage. Venusaur did 10 damage to Bulbasaur with Razor Leaf, while Bulbasaur only did 4 damage with the same attack.
The formula also shows why Magikarp deals damage even though Splash has a base damage of 0. One damage is always added onto the end of every attack.
Best Answer
Update: It appears that the conclusion below is false, and as of now we are unsure of the correlation between Weight/Height and any other of the Pokémon's stats. I have seen several counter-examples to the trend I observed, both from personal experience and from other people and so I am no longer confident that there is a relationship. Once more information, incorporating moveset and other variables (such as - "was it caught at this CP level or did you raise it to this CP level?"), comes to light, hopefully we will have a more definitive explanation for the variability of HP vs CP.
The tests I conducted showed that yes, weight (and possibly height) are relevant to a Pokémon's stats. From what I saw, for two Pokémon of the same CP, the one with higher weight will have higher HP. This means that it is more important to hold on to Heavier (XL) Pokémon and place less emphasis on raising XS Pokémon. I did not focus on height when I pulled my sample together, but there is no clear trend across the two examples I used, its effects will need to be looked into further.
The two separate cases I used to come to this conclusion are as follows-
First Case:
I captured two Pidgeys of the same CP level (93) in a very short time. Comparing their weights, I found that one had higher HP, and realized that this was positively correlated with weight. Interestingly, in this case the Pidgey with the larger height value was the one with less HP, which I thought may thought might indicate a negative correlation, but this was not consistent with the next case.
Second Case:
I had one sparrow of CP level 77 and another at a lower CP level, but with an (XL) tag for it's weight. I upgraded the lower one to CP 75, and discovered that the (XL) Pokémon had more health than its smaller cousin (who was two CP levels higher). This certainly offers more support in favor of weight factoring into a Pokémon's HP. Interestingly in this example the height increased along with the HP/weight, arguing against a negative correlation.
The amounts shown for HP differences may seem small, but keep in mind that this is at very low CP levels, so I expect the effect to be more noticeable at higher levels.
Obviously this is only two cases, so drawing conclusions based off of such a small sample size isn't ideal, and I will try to find more examples that can help shed light on this relationship. If anyone has any contradictory examples please post them, as it would definitely help clear this up.
Edit: I'll post the additional cases tomorrow, but I have found four more examples where a higher weight Pokémon of equal or lesser CP has a higher HP than its smaller cousin.